Voter-Initiated Anonymous Credential Recovery in Remote E-Voting: A Game-Based Security Analysis

Revote-based remote e-voting lets a voter override a ballot cast under pressure, but only while the voter's credential remains under the voter's exclusive control. When the credential is captured by malware, theft or observation, existing systems offer either no remedy or an identity-linked re-registration. The Anonymous Recovery Channel (ARC) of the Arcaunt architecture lets a voter revoke a captured credential and obtain a replacement through a pre-registered e-mail address, without disclosing their civil identity and without interacting with an administrator. This paper gives a game-based security analysis of ARC for the present Arcaunt construction, in which credential tags, blind indices and knowledge-based digests are HMAC-SHA3-256 values under keys held by a hardware security module (HSM), every ledger record is HSM-signed and counter-ordered, and every state-changing request takes effect only after a one-time nonce is returned from the bound mailbox. We prove that bindings are anonymous against the database, that recovery cannot be forged by a party that neither reads the bound mailbox nor breaks its origin authentication, provided the holder confirms only its own requests, and that the knowledge-based fallback is bounded by a global attempt budget and the min-entropy of the registered answers. We show that each credential chain has at most one valid credential however the three recovery paths interleave, and that a completed recovery ends a capturing adversary's influence on the voter's final ballot, with an explicit bound, provided the adversary does not read the recovery mailbox. These are post-episode guarantees: they end the adversary's influence once an episode of capture is over and the voter acts, not during the episode; a knowledge-based fallback at a few supervised terminals serves as a last resort when the adversary also holds the mailbox. All results are game-based, for a single election with static corruption, and assume an honest HSM; we make no simulation-based or universally composable claim and no claim of coercion resistance in the sense of Juels, Catalano and Jakobsson.